mandrel-platform 0.24.0 → 0.26.0

package/scripts/deploy-boot-smoke.mjs

@@ -40,10 +40,15 @@
  * appended to $GITHUB_ENV so the workflow's `Rollback failed workers` step
  * fires. Exit code 1 on any smoke failure.
  *
- * Wrangler: the workers.dev subdomain derivation shells out to the
- * consumer's lockfile-pinned `pnpm exec wrangler whoami` (installed by
- * setup-toolchain, preflighted via its `require-wrangler` input). This
- * script never fetches a registry-latest wrangler.
+ * Subdomain derivation (M14): the workers.dev account subdomain is derived
+ * via the Cloudflare REST endpoint
+ * `GET /accounts/{account_id}/workers/subdomain` using the in-scope
+ * CLOUDFLARE_API_TOKEN + CLOUDFLARE_ACCOUNT_ID — NOT `wrangler whoami`. This
+ * removes the root-wrangler dependency for probe-only consumers: every real
+ * consumer is a pnpm workspace with wrangler in an app sub-package (not the
+ * root), so the former `pnpm exec wrangler whoami` derivation failed the
+ * smoke preflight AFTER the worker already deployed. The REST call needs no
+ * wrangler at all.
  *
  * Environment contract (all read from process.env):
  *   DEPLOYED_WORKERS       csv of deployed worker names (required)
@@ -53,6 +58,8 @@
  *   WORKERS_DEV_SUBDOMAIN  explicit workers.dev slug (optional)
  *   VERIFY_COMMIT_SHA      'true' to assert the health JSON version field
  *   EXPECTED_SHA           the SHA verify-commit-sha asserts (github.sha)
+ *   CLOUDFLARE_API_TOKEN   CF API token for the subdomain REST derivation
+ *   CLOUDFLARE_ACCOUNT_ID  CF account id for the subdomain REST derivation
  *   SMOKE_FAILED_FILE      rollback-list path (default: a freshly-created
  *                          private temp dir via mkdtemp — never a predictable
  *                          world-writable path; CI sets this explicitly)
@@ -61,13 +68,16 @@
  * Exit codes:
  *   0 — every probe passed.
  *   1 — a probe failed (rollback list written), or the probe target could
- *       not be resolved (no subdomain derivable — no rollback list).
+ *       not be resolved (no subdomain derivable — no rollback list), or an
+ *       unhandled error crashed the run (terminal-write-before-exit — the
+ *       rollback file + smoke_failed=true flag are still written so the
+ *       workflow's rollback step fires, M2).
  */
 
 import { writeFileSync, appendFileSync, mkdtempSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
-import { execFileSync, spawnSync } from "node:child_process";
+import { spawnSync } from "node:child_process";
 
 // ---------------------------------------------------------------------------
 // Pure helpers (unit-tested)
@@ -87,12 +97,28 @@ export function parseSmokePaths(csv) {
 }
 
 /**
- * Extract the workers.dev account subdomain slug from `wrangler whoami`
- * output (the first `<slug>.workers.dev` token). Returns null when absent.
+ * Extract the workers.dev account subdomain slug from a Cloudflare REST
+ * `GET /accounts/{account_id}/workers/subdomain` response body (M14). The API
+ * returns `{ success, result: { name: "<slug>" } }`; this reads the top-level
+ * `result.name`. Returns null when the body is not JSON, not the expected
+ * shape, unsuccessful, or the name is missing / not a non-empty string.
+ * Deliberately tolerant of a full `<slug>.workers.dev` value (some responses
+ * echo the host) by stripping a trailing `.workers.dev`.
  */
-export function extractSubdomain(whoamiOutput) {
-  const m = String(whoamiOutput ?? "").match(/([A-Za-z0-9-]+)\.workers\.dev/);
-  return m ? m[1] : null;
+export function extractSubdomain(responseBody) {
+  let parsed;
+  try {
+    parsed = JSON.parse(responseBody);
+  } catch {
+    return null;
+  }
+  if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) return null;
+  if (parsed.success === false) return null;
+  const result = parsed.result;
+  if (result === null || typeof result !== "object" || Array.isArray(result)) return null;
+  const name = result.name;
+  if (typeof name !== "string" || name.length === 0) return null;
+  return name.replace(/\.workers\.dev$/, "");
 }
 
 /**
@@ -199,7 +225,7 @@ export async function runSmoke(env, deps = {}) {
     log = (line) => process.stdout.write(`${line}\n`),
     probe = probeUrl,
     runShell = defaultRunShell,
-    whoami = defaultWhoami,
+    deriveSubdomain = defaultDeriveSubdomain,
   } = deps;
 
   const workers = parseCsv(env.DEPLOYED_WORKERS);
@@ -228,15 +254,20 @@ export async function runSmoke(env, deps = {}) {
   // ----- Built-in probe -----
   // Resolve the workers.dev subdomain slug. NEVER the account ID (a UUID) —
   // workers.dev subdomains are keyed by the account name/slug. Prefer the
-  // explicit input, else derive from `wrangler whoami`.
+  // explicit input, else derive from the Cloudflare REST endpoint
+  // GET /accounts/{account_id}/workers/subdomain (M14 — no wrangler needed).
   let subdomain = (env.WORKERS_DEV_SUBDOMAIN ?? "").trim();
   if (!subdomain && !smokeBaseUrl) {
-    log("::group::Deriving workers.dev subdomain from wrangler whoami");
-    subdomain = extractSubdomain(whoami());
+    log("::group::Deriving workers.dev subdomain from the Cloudflare REST API");
+    subdomain = await deriveSubdomain({
+      accountId: (env.CLOUDFLARE_ACCOUNT_ID ?? "").trim(),
+      apiToken: (env.CLOUDFLARE_API_TOKEN ?? "").trim(),
+    });
     if (!subdomain) {
       log(
-        "::error::Could not derive workers.dev subdomain from 'wrangler whoami'. " +
-          "Pass workers_dev_subdomain or smoke_base_url explicitly."
+        "::error::Could not derive workers.dev subdomain from the Cloudflare REST API " +
+          "(GET /accounts/{account_id}/workers/subdomain). Check CLOUDFLARE_ACCOUNT_ID / " +
+          "CLOUDFLARE_API_TOKEN, or pass workers_dev_subdomain / smoke_base_url explicitly."
       );
       log("::endgroup::");
       // No rollback list: the target could not be resolved, so nothing was
@@ -306,18 +337,30 @@ function defaultRunShell(command, extraEnv) {
   return res.status ?? 1;
 }
 
-function defaultWhoami() {
-  // Consumer lockfile-pinned wrangler (`pnpm exec wrangler`), installed and
-  // preflighted by setup-toolchain (require-wrangler). Failure tolerated —
-  // an empty output falls through to the "could not derive" error above.
+/**
+ * Derive the workers.dev subdomain slug via the Cloudflare REST endpoint
+ * `GET /accounts/{account_id}/workers/subdomain` (M14). Uses the in-scope
+ * CLOUDFLARE_* creds — no wrangler. Any failure (missing creds, network
+ * error, non-2xx, unparsable body) is tolerated and returns null, which the
+ * caller surfaces as the "could not derive" error above. fetchImpl is
+ * injectable for the test suite.
+ */
+export async function defaultDeriveSubdomain({ accountId, apiToken }, fetchImpl = fetch) {
+  if (!accountId || !apiToken) return null;
+  const url = `https://api.cloudflare.com/client/v4/accounts/${encodeURIComponent(accountId)}/workers/subdomain`;
   try {
-    return execFileSync("pnpm", ["exec", "wrangler", "whoami"], {
-      encoding: "utf8",
-      stdio: ["ignore", "pipe", "ignore"],
-      maxBuffer: 8 * 1024 * 1024,
+    const res = await fetchImpl(url, {
+      method: "GET",
+      headers: {
+        Authorization: `Bearer ${apiToken}`,
+        Accept: "application/json",
+      },
+      signal: AbortSignal.timeout(15000),
     });
+    if (!res.ok) return null;
+    return extractSubdomain(await res.text());
   } catch {
-    return "";
+    return null;
   }
 }
 
@@ -341,18 +384,55 @@ export function resolveFailedFile(env, mkdtempImpl = mkdtempSync) {
   return join(mkdtempImpl(join(tmpdir(), "deploy-boot-smoke-")), "smoke-failed-workers.txt");
 }
 
+/**
+ * Write the rollback terminal state: the failed-worker list to `failedFile`
+ * (overwrite, never append) and `smoke_failed=true` to $GITHUB_ENV so the
+ * workflow's rollback step fires. No-op when `failedWorkers` is empty.
+ * Extracted so both the normal smoke-failure path AND the crash path (M2 —
+ * terminal-write-before-exit) share one writer, and so the write is
+ * unit-testable via injected fs seams.
+ *
+ * Overwrite rationale: a reused self-hosted runner may carry a stale list
+ * from a previous run, and rolling back workers this run never deployed would
+ * widen the blast radius.
+ */
+export function writeRollbackState(
+  failedFile,
+  failedWorkers,
+  { githubEnv, writeFile = writeFileSync, appendFile = appendFileSync } = {}
+) {
+  if (!failedWorkers || failedWorkers.length === 0) return;
+  writeFile(failedFile, `${failedWorkers.join("\n")}\n`);
+  if (githubEnv) {
+    appendFile(githubEnv, "smoke_failed=true\n");
+  }
+}
+
 async function main() {
   const failedFile = resolveFailedFile(process.env);
-  const { exitCode, failedWorkers } = await runSmoke(process.env);
-
-  if (failedWorkers.length > 0) {
-    // Overwrite (never append): a reused self-hosted runner may carry a
-    // stale list from a previous run, and rolling back workers this run
-    // never deployed would widen the blast radius.
-    writeFileSync(failedFile, `${failedWorkers.join("\n")}\n`);
-    if (process.env.GITHUB_ENV) {
-      appendFileSync(process.env.GITHUB_ENV, "smoke_failed=true\n");
-    }
+  let exitCode;
+  try {
+    const result = await runSmoke(process.env);
+    exitCode = result.exitCode;
+    writeRollbackState(failedFile, result.failedWorkers, {
+      githubEnv: process.env.GITHUB_ENV,
+    });
+  } catch (err) {
+    // Crash path (M2): an unhandled error must NOT leave a deployed worker
+    // serving unverified code with no rollback. Write the terminal rollback
+    // state — rolling back EVERY deployed worker, since the crash gives no
+    // per-worker attribution — BEFORE exiting non-zero, so the workflow's
+    // rollback step still fires. This is the terminal-write-before-exit
+    // guarantee the former (write-only-on-a-clean-return) shape lacked.
+    process.stdout.write(
+      `::error::deploy-boot-smoke crashed: ${err?.message ?? err}. ` +
+        "Marking every deployed worker for rollback.\n"
+    );
+    const deployed = uniqueSorted(parseCsv(process.env.DEPLOYED_WORKERS));
+    writeRollbackState(failedFile, deployed, {
+      githubEnv: process.env.GITHUB_ENV,
+    });
+    exitCode = 1;
   }
   process.exit(exitCode);
 }

package/scripts/deploy-boot-smoke.test.mjs

@@ -11,6 +11,8 @@ import {
   probeUrl,
   runSmoke,
   resolveFailedFile,
+  defaultDeriveSubdomain,
+  writeRollbackState,
 } from "./deploy-boot-smoke.mjs";
 
 // ---------------------------------------------------------------------------
@@ -29,26 +31,67 @@ test("parseSmokePaths enforces a leading slash", () => {
 });
 
 // ---------------------------------------------------------------------------
-// extractSubdomain
+// extractSubdomain — parses the Cloudflare REST subdomain response (M14)
 // ---------------------------------------------------------------------------
 
-test("extractSubdomain finds the first workers.dev slug in whoami output", () => {
-  const whoami = [
-    "Getting User settings...",
-    "👋 You are logged in!",
-    "┌──────────────┬──────────────────────────┐",
-    "│ Account Name │ dsj1984's Account        │",
-    "│ Subdomain    │ dsj1984.workers.dev      │",
-    "└──────────────┴──────────────────────────┘",
-  ].join("\n");
-  assert.equal(extractSubdomain(whoami), "dsj1984");
+test("extractSubdomain reads result.name from the REST subdomain response", () => {
+  assert.equal(
+    extractSubdomain('{"success":true,"errors":[],"messages":[],"result":{"name":"dsj1984"}}'),
+    "dsj1984"
+  );
+});
+
+test("extractSubdomain strips a trailing .workers.dev when the API echoes the host", () => {
+  assert.equal(extractSubdomain('{"success":true,"result":{"name":"dsj1984.workers.dev"}}'), "dsj1984");
 });
 
-test("extractSubdomain returns null when no slug is present", () => {
-  assert.equal(extractSubdomain("no subdomain here"), null);
+test("extractSubdomain returns null for unsuccessful, malformed, or missing bodies", () => {
+  assert.equal(extractSubdomain('{"success":false,"result":null}'), null);
+  assert.equal(extractSubdomain('{"result":{"name":""}}'), null);
+  assert.equal(extractSubdomain('{"result":{"name":42}}'), null);
+  assert.equal(extractSubdomain('{"result":{}}'), null);
+  assert.equal(extractSubdomain('{"result":"dsj1984"}'), null);
+  assert.equal(extractSubdomain("<html>not json</html>"), null);
   assert.equal(extractSubdomain(""), null);
 });
 
+// ---------------------------------------------------------------------------
+// defaultDeriveSubdomain — the REST GET /accounts/{id}/workers/subdomain call
+// ---------------------------------------------------------------------------
+
+test("defaultDeriveSubdomain calls the workers/subdomain endpoint with a bearer token", async () => {
+  let seenUrl;
+  let seenOptions;
+  const fetchImpl = async (url, options) => {
+    seenUrl = url;
+    seenOptions = options;
+    return { ok: true, text: async () => '{"success":true,"result":{"name":"dsj1984"}}' };
+  };
+  const slug = await defaultDeriveSubdomain({ accountId: "acct-123", apiToken: "tok-abc" }, fetchImpl);
+  assert.equal(slug, "dsj1984");
+  assert.equal(
+    seenUrl,
+    "https://api.cloudflare.com/client/v4/accounts/acct-123/workers/subdomain"
+  );
+  assert.equal(seenOptions.method, "GET");
+  assert.equal(seenOptions.headers.Authorization, "Bearer tok-abc");
+});
+
+test("defaultDeriveSubdomain returns null without creds, on non-2xx, and on network error", async () => {
+  assert.equal(await defaultDeriveSubdomain({ accountId: "", apiToken: "tok" }, async () => ({})), null);
+  assert.equal(await defaultDeriveSubdomain({ accountId: "a", apiToken: "" }, async () => ({})), null);
+  assert.equal(
+    await defaultDeriveSubdomain({ accountId: "a", apiToken: "t" }, async () => ({ ok: false, text: async () => "" })),
+    null
+  );
+  assert.equal(
+    await defaultDeriveSubdomain({ accountId: "a", apiToken: "t" }, async () => {
+      throw new Error("ECONNRESET");
+    }),
+    null
+  );
+});
+
 // ---------------------------------------------------------------------------
 // parseVersionField — the jq/JSON.parse replacement for grep-for-"version"
 // ---------------------------------------------------------------------------
@@ -315,21 +358,30 @@ test("runSmoke fails without a rollback list when no subdomain is derivable", as
   const { log, lines } = collectLogs();
   const result = await runSmoke(
     { DEPLOYED_WORKERS: "api", SMOKE_PATHS: "/health" },
-    { log, whoami: () => "not logged in", probe: async () => ({ status: 200, body: "{}" }) }
+    { log, deriveSubdomain: async () => null, probe: async () => ({ status: 200, body: "{}" }) }
   );
   assert.equal(result.exitCode, 1);
   assert.deepEqual(result.failedWorkers, []);
   assert.ok(lines.some((l) => l.includes("Could not derive workers.dev subdomain")));
 });
 
-test("runSmoke derives the subdomain from whoami output when not provided", async () => {
+test("runSmoke derives the subdomain via the REST endpoint when not provided", async () => {
   const { log } = collectLogs();
   const probed = [];
+  let seenCreds;
   const result = await runSmoke(
-    { DEPLOYED_WORKERS: "api", SMOKE_PATHS: "/health" },
+    {
+      DEPLOYED_WORKERS: "api",
+      SMOKE_PATHS: "/health",
+      CLOUDFLARE_ACCOUNT_ID: "acct-123",
+      CLOUDFLARE_API_TOKEN: "tok-abc",
+    },
     {
       log,
-      whoami: () => "│ Subdomain │ dsj1984.workers.dev │",
+      deriveSubdomain: async (creds) => {
+        seenCreds = creds;
+        return "dsj1984";
+      },
       probe: async (url) => {
         probed.push(url);
         return { status: 200, body: "{}" };
@@ -338,6 +390,8 @@ test("runSmoke derives the subdomain from whoami output when not provided", asyn
   );
   assert.equal(result.exitCode, 0);
   assert.deepEqual(probed, ["https://api.dsj1984.workers.dev/health"]);
+  // The REST creds are threaded through from the environment.
+  assert.deepEqual(seenCreds, { accountId: "acct-123", apiToken: "tok-abc" });
 });
 
 // ---------------------------------------------------------------------------
@@ -379,3 +433,70 @@ test("resolveFailedFile creates a private temp dir when SMOKE_FAILED_FILE is uns
   assert.equal(path, "/var/folders/xyz/deploy-boot-smoke-Zzz999/smoke-failed-workers.txt");
   assert.notEqual(path, "/tmp/smoke-failed-workers.txt");
 });
+
+// ---------------------------------------------------------------------------
+// writeRollbackState — the shared terminal writer (crash-path fix, M2)
+// ---------------------------------------------------------------------------
+
+test("writeRollbackState writes the sorted list and the smoke_failed flag", () => {
+  const writes = [];
+  const appends = [];
+  writeRollbackState("/tmp/failed.txt", ["api", "worker-cron"], {
+    githubEnv: "/tmp/gh-env",
+    writeFile: (path, data) => writes.push({ path, data }),
+    appendFile: (path, data) => appends.push({ path, data }),
+  });
+  assert.deepEqual(writes, [{ path: "/tmp/failed.txt", data: "api\nworker-cron\n" }]);
+  assert.deepEqual(appends, [{ path: "/tmp/gh-env", data: "smoke_failed=true\n" }]);
+});
+
+test("writeRollbackState is a no-op for an empty worker list", () => {
+  let wrote = false;
+  let appended = false;
+  writeRollbackState("/tmp/failed.txt", [], {
+    githubEnv: "/tmp/gh-env",
+    writeFile: () => {
+      wrote = true;
+    },
+    appendFile: () => {
+      appended = true;
+    },
+  });
+  assert.equal(wrote, false);
+  assert.equal(appended, false);
+});
+
+test("writeRollbackState skips the GITHUB_ENV append when githubEnv is unset (still writes the list)", () => {
+  const writes = [];
+  let appended = false;
+  writeRollbackState("/tmp/failed.txt", ["api"], {
+    writeFile: (path, data) => writes.push({ path, data }),
+    appendFile: () => {
+      appended = true;
+    },
+  });
+  assert.deepEqual(writes, [{ path: "/tmp/failed.txt", data: "api\n" }]);
+  assert.equal(appended, false);
+});
+
+// ---------------------------------------------------------------------------
+// Crash-path terminal write (M2): runSmoke throwing must still mark every
+// deployed worker for rollback. main() catches and calls writeRollbackState
+// with uniqueSorted(parseCsv(DEPLOYED_WORKERS)); this asserts the exact
+// derivation main() feeds the writer on the crash path.
+// ---------------------------------------------------------------------------
+
+test("crash-path derives the full deployed-worker rollback set (uniqueSorted + parseCsv)", () => {
+  // Mirrors main()'s catch block: on an unhandled error, EVERY deployed
+  // worker is marked (no per-worker attribution survives a crash).
+  const deployed = uniqueSorted(parseCsv("worker-cron, api ,worker-cron"));
+  const writes = [];
+  const appends = [];
+  writeRollbackState("/tmp/failed.txt", deployed, {
+    githubEnv: "/tmp/gh-env",
+    writeFile: (path, data) => writes.push({ path, data }),
+    appendFile: (path, data) => appends.push({ path, data }),
+  });
+  assert.deepEqual(writes, [{ path: "/tmp/failed.txt", data: "api\nworker-cron\n" }]);
+  assert.deepEqual(appends, [{ path: "/tmp/gh-env", data: "smoke_failed=true\n" }]);
+});

package/scripts/platform-repair.mjs

@@ -68,7 +68,12 @@ import { tmpdir } from "node:os";
 import { dirname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 
-import { buildReport, isFullSha } from "./check-pin-drift.mjs";
+import {
+  allConsumersErrored,
+  buildReport,
+  isFullSha,
+  pinDriftTokenProvided,
+} from "./check-pin-drift.mjs";
 import { defaultGhRunner } from "./lib/gh-json.mjs";
 import { parseSemver } from "./lib/semver-duration.mjs";
 
@@ -602,6 +607,13 @@ export function runRepair({
 }) {
   // Reuse the detector to classify every consumer (single SSOT for drift).
   const report = buildReport(config, runGh, nowMs);
+  // M11: mirror check-pin-drift's dead-credential signal. When EVERY consumer
+  // row errored the detector could read no repo at all — the signature of a
+  // provided-but-dead PIN_DRIFT_TOKEN (an expired PAT). The caller pairs this
+  // with `tokenProvided` to fail the run instead of silently reporting a green
+  // "no repairable drift" (which is what an all-error sweep degrades to, since
+  // every error row classifies `repairable: false, reason: "error"`).
+  const allErrored = allConsumersErrored(report);
   const latestTag = report.latestRelease?.tag ?? null;
   const targetSha = report.latestRelease?.sha ?? null;
   // The pin target is the latest release tag (so the `# <ref>` annotation reads
@@ -648,7 +660,14 @@ export function runRepair({
     }
   }
 
-  return { ref: effectiveRef, targetSha, dryRun, hasToken: Boolean(token), rows };
+  return {
+    ref: effectiveRef,
+    targetSha,
+    dryRun,
+    hasToken: Boolean(token),
+    allErrored,
+    rows,
+  };
 }
 
 // ---------------------------------------------------------------------------
@@ -743,6 +762,23 @@ export function runCli({
       }
     }
   }
+
+  // M11: the repair loop reads consumers with the SAME cross-repo credential the
+  // dashboard uses (PIN_DRIFT_TOKEN → GH_TOKEN). When that token was PROVIDED
+  // but every detector row errored, the credential is dead (expired PAT) rather
+  // than not-yet-provisioned — every consumer degraded to `error` / repairable
+  // false, which otherwise renders a reassuring green "no repairable drift". Fail
+  // the run loudly so the dead credential is fixed. The absent-token bootstrap
+  // (pinDriftTokenProvided false) keeps its exit-0 read-only behavior.
+  if (pinDriftTokenProvided(env) && report.allErrored) {
+    stderr.write(
+      "::error::[platform-repair] PIN_DRIFT_TOKEN was provided but every " +
+        "cross-repo consumer read errored — the credential is dead (likely an " +
+        "expired fine-grained PAT), not a not-yet-provisioned bootstrap. Rotate " +
+        "the token. See docs/runbooks/pin-drift-dashboard.md.\n",
+    );
+    return 1;
+  }
   return 0;
 }
 

package/scripts/platform-repair.test.mjs

@@ -21,6 +21,9 @@
  */
 
 import assert from "node:assert/strict";
+import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
 import { test } from "node:test";
 
 import {
@@ -32,6 +35,7 @@ import {
   parsePrNumberFromUrl,
   renderRepairPrBody,
   renderRepairReport,
+  runCli,
   runRepair,
 } from "./platform-repair.mjs";
 
@@ -269,6 +273,12 @@ function makeGh({ consumerWorkflow, npmVersion, openPrs = {}, calls }) {
 
 const noopGit = () => "";
 
+/** A minimal write-sink that records everything written, for stdout/stderr. */
+function capture() {
+  const chunks = [];
+  return { write: (s) => chunks.push(s), text: () => chunks.join("") };
+}
+
 function laggingConfig() {
   return {
     platformRepo: PLATFORM_REPO,
@@ -456,3 +466,106 @@ test("renderRepairReport tabulates outcomes and a repaired section", () => {
   assert.ok(text.includes("Repaired (1)"));
   assert.ok(text.includes("#101"));
 });
+
+// ---------------------------------------------------------------------------
+// M11 — provided-but-dead read credential vs. not-yet-provisioned bootstrap.
+// The repair loop reads consumers with the SAME cross-repo PAT the dashboard
+// uses (PIN_DRIFT_TOKEN → GH_TOKEN). When that PAT is provided-but-dead every
+// detector row errors → every consumer classifies `error`/repairable-false,
+// which otherwise renders a reassuring green "no repairable drift". runCli must
+// hard-fail on that when the token was provided, and stay exit-0 when it was
+// absent (bootstrap). Mirrors scripts/check-runner-health.mjs error-row
+// handling. (temp/audits/workflow-robustness-review-2026-07-05.md M11)
+// ---------------------------------------------------------------------------
+
+/**
+ * A gh runner where the platform's own release resolution succeeds but EVERY
+ * cross-repo consumer read fails non-404 (auth/transport) — the shape of a dead
+ * cross-repo PAT. No PR surface is reached because every consumer errors out
+ * before repair.
+ */
+function makeAllConsumersFailGh() {
+  return (args) => {
+    const path = args[1];
+    if (args[0] !== "api") {
+      throw new Error(`unexpected non-api gh call under dead credential: ${args.join(" ")}`);
+    }
+    if (path === `repos/${PLATFORM_REPO}/releases/latest`) {
+      return JSON.stringify({ tag_name: "mandrel-platform-v1.2.3", published_at: "2020-01-01T00:00:00Z" });
+    }
+    if (path === `repos/${PLATFORM_REPO}/git/ref/tags/mandrel-platform-v1.2.3`) {
+      return JSON.stringify({ object: { sha: LATEST_SHA, type: "commit" } });
+    }
+    if (/\/contents\/\.github\/workflows/.test(path)) {
+      // 403 (not 404) → fail-closed error row, mirroring an expired PAT.
+      const err = new Error("gh: Forbidden (HTTP 403)");
+      err.stderr = "gh: Forbidden (HTTP 403)\n";
+      throw err;
+    }
+    if (/^repos\/[^/]+\/[^/]+$/.test(path)) {
+      return JSON.stringify({ default_branch: "main" });
+    }
+    throw new Error(`unexpected gh api path: ${path}`);
+  };
+}
+
+function deadCredConfigFile() {
+  const dir = mkdtempSync(join(tmpdir(), "platform-repair-dead-"));
+  const p = join(dir, "consumers.json");
+  writeFileSync(
+    p,
+    JSON.stringify({
+      platformRepo: PLATFORM_REPO,
+      consumers: [
+        { name: "domio", repo: "dsj1984/domio" },
+        { name: "athportal", repo: "dsj1984/athportal" },
+      ],
+    }),
+  );
+  return { dir, p };
+}
+
+test("runCli: PROVIDED-but-dead PIN_DRIFT_TOKEN (every consumer read errors) exits 1 with ::error::", () => {
+  const { dir, p } = deadCredConfigFile();
+  const stderr = capture();
+  try {
+    const code = runCli({
+      argv: ["--config", p],
+      env: { PIN_DRIFT_TOKEN: "ghp_expired" },
+      runGh: makeAllConsumersFailGh(),
+      runGit: noopGit,
+      runSync: () => {
+        throw new Error("must not sync under a dead credential");
+      },
+      stdout: capture(),
+      stderr,
+      summaryPath: undefined,
+    });
+    assert.equal(code, 1);
+    assert.match(stderr.text(), /::error::/);
+    assert.match(stderr.text(), /credential is dead/);
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+test("runCli: ABSENT PIN_DRIFT_TOKEN bootstrap (every consumer read errors, token unset) stays exit 0", () => {
+  const { dir, p } = deadCredConfigFile();
+  try {
+    const code = runCli({
+      argv: ["--config", p],
+      env: {}, // PIN_DRIFT_TOKEN absent → not-yet-provisioned bootstrap.
+      runGh: makeAllConsumersFailGh(),
+      runGit: noopGit,
+      runSync: () => {
+        throw new Error("must not sync during bootstrap");
+      },
+      stdout: capture(),
+      stderr: capture(),
+      summaryPath: undefined,
+    });
+    assert.equal(code, 0);
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+  }
+});